Dr. David L.

Dill
Professor of Computer Science
Stanford University
Gates Bldg Rm 344
Stanford, CA 94305-9030
Office: (650) 725-3642
Fax: (650) 725-6949
dill@cs.stanford.edu

February 3, 2010

Mr. Navin Chawla

Chief Election Commissioner
Election Commission of India
Nirvachan Sadan
Ashoka Road, New Delhi 110001

I am writing this letter at the request of Satya Dosapati from the Save Indian Democracy
Organization with regard to the ongoing debate on the usage of EVMs in India. I am an
American computer science professor who has spent significant time over the last six years on
policy issues in electronic voting. During that time, I have founded two organizations, testified
before the U.S. Senate, and appeared in several nationally distributed news shows and
documentaries. I would like to share with you some facts and conclusions I have come to during
that work.

An important function of elections is to establish the legitimacy of the elected officials in the
eyes of the public. Skeptical, untrusting observers should be able to see that election results are
correct. It is not sufficient for election results to be accurate; the public must know that the
results are accurate. Civil society is damaged if elections are not credible, even when fraud
cannot be demonstrated.

In traditional elections, paper ballots contribute to election credibility because voters can ensure
that their votes have been properly recorded (when they write them on the ballot), and poll
workers and observers at the polling place can ensure that ballots are not changed, added or
removed after being deposited in the ballot box. In contrast, purely electronic voting machines do
not allow voters to verify that their votes have been accurately recorded, and do not allow
observers to witness that the ballots have not been tampered with. Electronic voting machines
provide no evidence during or after the election to convince a skeptic that the election results are
accurate.

It is not clear that this situation would be acceptable even if electronic voting machines could be
guaranteed to be accurate and honest. But such assurances are well beyond the current state of
computer technology. It is not practical to design fully error-free and reliable computing
equipment. More importantly, it is not feasible to prevent malicious changes to the machines'
hardware or software. Computers are especially vulnerable to malicious changes by insiders
such as designers, programmers, manufacturers, maintenance technicians, etc. Indeed, it is not
known how to build trustworthy paperless electronic voting systems even using extreme security
measures. Of course, these problems are magnified enormously when the design of the machines
is held secret from independent reviewers.

I understand that the argument has been raised in India that the EVMs are safe because they are
not connected to a network. All of the concerns I raise apply to non-networked machines, since
voting machines in the U.S. are also never connected to the Internet. For example, a
manufacturer or technician can maliciously change the software or hardware on a machine
whether it is connected to a network or not.

With current technology, the only trustworthy voting methods are those that allow individual
voters to verify that their votes have been properly recorded on a paper ballot. In the United
States, most voting systems rely on paper ballots that are filled out directly by the voters, and
counted either by hand or by machine. If the votes are counted by machine, it is necessary to
audit the performance of the machines by choosing groups of ballots at random and counting
them by hand.

In 2003, I authored the ``Resolution on Electronic Voting,'' which has been endorsed by
thousands of computer professionals including many of the world's most respected computer
scientists. It states: ``Computerized voting equipment is inherently subject to programming
error, equipment malfunction, and malicious tampering.'' It is time to recognize the reality that
there is no basis for public trust in paperless electronic voting equipment.

I would be happy to discuss this topic with you further, including technical issues, referring you
to individuals with various kinds of expertise whom know, or sharing more detailed experiences
with electronic voting issues in the United States. We can converse by telephone, email, or you
would be welcome to visit me at Stanford if you are in the United States. I look forward to
hearing from you.

Sincerely,

David L. Dill